I also want to point out that Windows will set the undeclared value 0x4. I don't know what this value does, if anything.

To decode this value, you can go through the property value definitions in the KB article from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. Here's an example: